SQL Injection Vulnerability in Icegram Express Plugin Affects Sensitive Data Extraction
CVE-2024-4845
8.8HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 12 June 2024
What is CVE-2024-4845?
The Icegram Express plugin for WordPress features a significant SQL Injection vulnerability due to inadequate escaping of user-supplied input within the ‘options[list_id]’ parameter. This issue exists across all versions up to and including 5.7.22. The lack of proper preparation for SQL queries allows authenticated users with Subscriber-level access and above to inject additional SQL commands. Such exploits can lead to unauthorized database access and potentially expose sensitive information, posing a significant risk to website integrity and user data.
Affected Version(s)
Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress 0 <= 5.7.22